# CVE-2026-57411: Aman CF7 Views DOM-based XSS in Complete Entry Management for Contact Form 7

Source: https://junglewise.ai/threats/cve-2026-57411-aman-cf7-views-dom-based-xss-in-complete-entry-management-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-57411 · Severity: high · CVSS 7.1 · Published 2026-07-13

A security vulnerability exists in the CF7 Views plugin for WordPress, which is used to manage and display Contact Form 7 entries. An attacker could use this flaw to execute malicious scripts in the browser of a site visitor or administrator, potentially leading to unauthorized actions or the theft of sensitive session information. This occurs when a user interacts with a specially crafted link or page created by the attacker.

Vendors: [Aman](https://junglewise.ai/threats/vendors/aman).

## Quick answers

**Is CVE-2026-57411 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57411 being exploited in the wild.

**How severe is CVE-2026-57411?** High severity, with a CVSS score of 7.1, published 13 July 2026.

**Which products and versions are affected?** Aman CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.2.

**Is there a fix for CVE-2026-57411?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-57411 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-57411?** Check whether you run Aman CF7 Views – Complete Entry Management for Contact Form 7 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Aman CF7 Views – Complete Entry Management for Contact Form 7 plugin for WordPress is vulnerable to DOM-based Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. The flaw exists in versions up to and including 3.2.2. An unauthenticated remote attacker can exploit this by tricking a user into visiting a crafted URL or interacting with a malicious page element. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session, which can be used to bypass same-origin policies or perform actions on behalf of the user. The issue is addressed in version 3.2.3.

## Affected products

- Aman CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.2

## Timeline

- 2026-05-08: other: Vulnerability reported by ParkHyunWoo
- 2026-07-08: advisory: Patchstack advisory published
- 2026-07-13: disclosed: CVE published to NVD

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/Wordpress/Plugin/cf7-views/vulnerability/wordpress-cf7-views-complete-entry-management-for-contact-form-7-plugin-3-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/Wordpress/Plugin/cf7-views/vulnerability/wordpress-cf7-views-complete-entry-management-for-contact-form-7-plugin-3-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve)